fix: check for absolute url prefixes with separate protocol strings

zimeg · zimeg · commit b154b6b910ef · 2025-03-18T16:45:02.000-07:00
diff --git a/packages/web-api/src/WebClient.spec.ts b/packages/web-api/src/WebClient.spec.ts
@@ -780,13 +780,19 @@ describe('WebClient', () => {
       await client.apiCall('method');
     });
 
-    it('should send requests to an absolute URL', async () => {
+    it('should send requests to an absolute URL as default', async () => {
       nock('http://12.34.56.78/').post('/api/method').reply(200, { ok: true });
       const client = new WebClient(token);
       await client.apiCall('http://12.34.56.78/api/method');
     });
 
-    it('should send requests to the default URL', async () => {
+    it('should send requests to the absolute URL if absolute is allowed', async () => {
+      nock('https://example.com/').post('/api/method').reply(200, { ok: true });
+      const client = new WebClient(token, { allowAbsoluteUrls: true });
+      await client.apiCall('https://example.com/api/method');
+    });
+
+    it('should send requests to the default URL if absolute not allowed', async () => {
       nock('https://slack.com/').post('/api/https://example.com/api/method').reply(200, { ok: true });
       const client = new WebClient(token, { allowAbsoluteUrls: false });
       await client.apiCall('https://example.com/api/method');
diff --git a/packages/web-api/src/WebClient.ts b/packages/web-api/src/WebClient.ts
@@ -744,7 +744,8 @@ export class WebClient extends Methods {
    * @param url - The resource to POST to. Either a Slack API method or absolute URL.
    */
   private deriveRequestUrl(url: string): string {
-    if (url.startsWith('https' || 'http') && this.allowAbsoluteUrls) {
+    const isAbsoluteURL = url.startsWith('https://') || url.startsWith('http://');
+    if (isAbsoluteURL && this.allowAbsoluteUrls) {
       return url;
     }
     return `${this.axios.getUri() + url}`;
